Sammie:
thanks for the code mod snippets.
I work at hfw and am attempting to put this to use on one of the Dolphin installs that repeatedly gets suspended from RFI injections, etc...(seems like all I do is chase this exploit around.)

boonex says it's our register_globals=on on our VPSs.
We'd like to think it's the 777 perm'd directories
but I have seen RFIs even with it off.

Believe me, I want to see this activity solved once and for all.
I remain hopeful.

You mentioned "here see more is another exploit found" : can you elaborate, if not openly then some other way?